Google Chrome EUVD-2026-28045

The victim must be running Google Chrome prior to 148.0.7778.96 and must actively visit a crafted HTML page under the attacker's control, satisfying the UI:R requirement - drive-by exploitation without any user click or navigation is not possible. The attack is reachable from any network origin with no attacker-side privileges or authentication required (PR:N, AV:N). The ORB feature is active in Chrome's default configuration; no special user setting or non-default deployment mode is required to be vulnerable. Exploitation is limited in scope: the bypass grants access to opaque cross-origin response bodies, not arbitrary OS-level code execution or full browser escape. The victim must also have a cross-origin session or resource accessible at the time of the attack for the leak to yield useful data.

The CVSS 3.1 base score of 6.3 (Medium) reflects broad attack surface: network-reachable (AV:N), no complexity barrier (AC:L), and no attacker privileges required (PR:N). The required user interaction (UI:R) is the primary friction - passive, automated mass exploitation is not possible, consistent with SSVC's 'Automatable: no' rating. Impact is bounded: C:L/I:L/A:L in the provided vector, though independently a site isolation bypass primarily produces a confidentiality leak, with integrity and availability impacts not clearly supported by the ORB bypass description. EPSS at 0.03% (8th percentile) is very low, meaning exploitation activity in the wild is not being observed, corroborating SSVC's 'Exploitation: none' and absence from CISA KEV. SSVC 'Technical Impact: partial' further confirms this is not a full-system compromise vector. The overall signal consensus is clear: this is a real but moderate-priority issue - patch in the normal enterprise browser update cycle, not an emergency break-fix. The site isolation bypass does have meaningful potential in targeted espionage scenarios where an attacker can reliably lure a high-value user.

An attacker registers a domain and publishes a crafted HTML page that issues cross-origin fetch requests in a pattern that exploits the ORB privilege boundary flaw, causing Chrome to expose the body of an opaque response that should be blocked. The attacker delivers a link to the page to a targeted victim via phishing email or malicious advertisement, and upon the victim loading the page in an unpatched Chrome browser, the attacker's script reads cross-origin response data - such as authenticated API responses or internal resource content from another site the victim is logged into. No public exploit code has been identified at time of analysis.